If I disconnect the coolant temp sensor, the fan turns on automatically and stays on. This is the fail safe mode (am assuming). Disconnecting the coolant sensor also causes the engine to misfire or have trouble starting.

The coolant temp sensor is within spec (about 3K ohm cold and 300 Ohm when engine is hot).

There are only two coolant temp sensors that I can see. Both are connected to the radiator top hose, near the cylinder head. One is for the dash gauge and one for the fan.

Do I need to start looking for replacement ECU, or is there a better solution?

You could investigate the ECU response by temporarily wiring a 4k7 potentiometer into the CTS plug. You could relate the 'fan on' resistance to equivalent temperature via the specified behaviour of the CTS.

Does the temperature gauge actually rise? It does seem to take a lot to get a K-Series fan to kick in, especially in the winter. When bleeding the cooling system it takes a good 15 odd minutes of idling before the fan kicks in (with me worrying that I’ve cooked it in the meantime!).

Yes. The gauge sensor is seperate to the cts but it does rise normally.
The engine overheats to the point the coolant boils in and escapes from the expansion tank and the engine starts burning oil - if stuck in a traffic jam.

The cts is definitely working fine - in that it is changing its resistance (perfectly within spec) when tested in situ, as the engine warms up.
I'll see what the 5k pot does. If it does switch the fan on then I'll be able to measure the resistance at which the fan was activated. It should give me a better idea of where to look for the fault.
As a side note, even though the ecu switches on the fan if the sensor is disconnected, the engine check light doesn't come on(??)

Cabin heater is normal - am using the old technique of heater on full blast to keep engine temp down when stuck in traffic.
Coolant flow appears to be ok. Although, I don't understand how coolant flow would make a difference here since the cts is heating up to give the correct resistance readings.
The radiator did have some radweld put into it but, as I said above, if the cts heats up and gives the correct resistance readings, then that part of the radiator fan/cooling system circuit must be functioning ok, correct?
The 5k pot has arrived and I will use that sometime this coming week and see if I can activate the cooling fan by dropping the resistance down to about 300 ohms.
If so, then I'll check the cts wiring condition and resistance. If that all checks out, then it's back to assuming a faulty ecu.

I believe the CTS would still be in the 'short' coolant circuit even when the 'long' circuit through the radiator is closed, either by blockage or thermostat.
Can you feel heat across the whole width of the radiator?